kernel/linux.git/drivers/usb/chipidea, branch v6.18.21

usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke()

2026-03-04T12:20:35+00:00

[ Upstream commit cea2a1257a3b5ea3e769a445b34af13e6aa5a123 ] The ChipIdea UDC driver can encounter "not page aligned sg buffer" errors when a USB device is reconnected after being disconnected during an active transfer. This occurs because _ep_nuke() returns requests to the gadget layer without properly unmapping DMA buffers or cleaning up scatter-gather bounce buffers. Root cause: When a disconnect happens during a multi-segment DMA transfer, the request's num_mapped_sgs field and sgt.sgl pointer remain set with stale values. The request is returned to the gadget driver with status -ESHUTDOWN but still has active DMA state. If the gadget driver reuses this request on reconnect without reinitializing it, the stale DMA state causes _hardware_enqueue() to skip DMA mapping (seeing non-zero num_mapped_sgs) and attempt to use freed/invalid DMA addresses, leading to alignment errors and potential memory corruption. The normal completion path via _hardware_dequeue() properly calls usb_gadget_unmap_request_by_dev() and sglist_do_debounce() before returning the request. The _ep_nuke() path must do the same cleanup to ensure requests are returned in a clean, reusable state. Fix: Add DMA unmapping and bounce buffer cleanup to _ep_nuke() to mirror the cleanup sequence in _hardware_dequeue(): - Call usb_gadget_unmap_request_by_dev() if num_mapped_sgs is set - Call sglist_do_debounce() with copy=false if bounce buffer exists This ensures that when requests are returned due to endpoint shutdown, they don't retain stale DMA mappings. The 'false' parameter to sglist_do_debounce() prevents copying data back (appropriate for shutdown path where transfer was aborted). Signed-off-by: Mario Peter Reviewed-by: Xu Yang Acked-by: Peter Chen Link: https://patch.msgid.link/20260108165902.795354-1-mario.peter@leica-geosystems.com Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin

usb: chipidea: imx: improve usbmisc_imx7d_pullup()

2025-08-13T15:19:10+00:00

When add workaround for ERR051725, the usbmisc will put PHY to Non-driving mode (OPMODE = 01) after stopping the device controller and put PHY back to Normal mode (OPMODE = 00) after starting the device controller. However, this will bring issue for host controller. Because the PHY may stay in Non-driving mode after switching the role from device to host. Then the port will not work if USB device is attached. To fix this issue, improving the workaround by putting PHY to Non-driving mode for a certain period and back to Normal mode finally. To make host detect a disconnect signal, the period should be at least 125us (a micro-frame time) for high-speed link. And only working as high-speed mode will need workaround for ERR051725. So this will also filter the pullup event for high-speed. Fixes: 11992b410083 ("usb: chipidea: imx: implement workaround for ERR051725") Reviewed-by: Jun Li Signed-off-by: Xu Yang Acked-by: Peter Chen Link: https://lore.kernel.org/r/20250811100833.862876-1-xu.yang_2@nxp.com Signed-off-by: Greg Kroah-Hartman

usb: chipidea: imx: Add a missing blank line

2025-07-21T14:31:37+00:00

Fix a checkpatch warning: CHECK: Please use a blank line after function/struct/union/enum declarations Reported-by: Xu Yang Acked-by: Peter Chen Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/36d1c961-319e-4457-bdc1-69f8b6bed33e@sabinyo.mountain Signed-off-by: Greg Kroah-Hartman

usb: chipidea: s32g: Add usb support for s32g3

2025-07-07T09:06:13+00:00

Enable USB driver for the s32g3 USB device. Signed-off-by: Ghennadi Procopciuc Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/1733ae21-7257-4fdd-8249-7eaebbf769a2@sabinyo.mountain Signed-off-by: Greg Kroah-Hartman

usb: chipidea: s32g: Add usb support for s32g2

2025-07-07T09:06:13+00:00

Enable USB driver for s32g2. This chip has an errata ERR050474[1] so we need to set S32G_UCMALLBE to avoid some memory corruption. I have include the description below: ERR050474: USB : USB data may be corrupted if transaction size is non-multiple of 32bits Description When USB issues narrow length transfers i.e. AHB transaction size is less than 4bytes, data for that transaction will get corrupted. Narrow length transactions can occur if the transaction size is non-multiple of four bytes, error scenarios terminate the transactions early or if the address offset programmed in QTD is 4 Byte unaligned. This happens because the SoC NOC is not able to handle the byte strobes generated by USB controller and is dependent on its internally generates byte strobes. Workaround Narrow transfers work properly on bypassing USB controller’s byte generation logic. This can be done by setting UCMALLBE (bit 15, USB Core Master All Byte Enable) bit of UOTGNC_CR. Link: https://www.nxp.com/webapp/Download?colCode=S32G2_1P77B Signed-off-by: Ghennadi Procopciuc Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/abb2ed5d-f01a-48f6-b1ae-6f8f39ae40fa@sabinyo.mountain Signed-off-by: Greg Kroah-Hartman

Merge merge point of tag 'usb-6.16-rc5' into usb-next

2025-07-05T05:52:33+00:00

We need the USB fixes in here as well to build on top of for other changes that depend on them. Signed-off-by: Greg Kroah-Hartman

usb: chipidea: udc: disconnect/reconnect from host when do suspend/resume

2025-06-19T10:36:43+00:00

Shawn and John reported a hang issue during system suspend as below: - USB gadget is enabled as Ethernet - There is data transfer over USB Ethernet (scp a big file between host and device) - Device is going in/out suspend (echo mem > /sys/power/state) The root cause is the USB device controller is suspended but the USB bus is still active which caused the USB host continues to transfer data with device and the device continues to queue USB requests (in this case, a delayed TCP ACK packet trigger the issue) after controller is suspended, however the USB controller clock is already gated off. Then if udc driver access registers after that point, the system will hang. The correct way to avoid such issue is to disconnect device from host when the USB bus is not at suspend state. Then the host will receive disconnect event and stop data transfer in time. To continue make USB gadget device work after system resume, this will reconnect device automatically. To make usb wakeup work if USB bus is already at suspend state, this will keep connection for it only when USB device controller has enabled wakeup capability. Reported-by: Shawn Guo Reported-by: John Ernberg Closes: https://lore.kernel.org/linux-usb/aEZxmlHmjeWcXiF3@dragon/ Tested-by: John Ernberg # iMX8QXP Fixes: 235ffc17d014 ("usb: chipidea: udc: add suspend/resume support for device controller") Cc: stable Reviewed-by: Jun Li Signed-off-by: Xu Yang Acked-by: Peter Chen Link: https://lore.kernel.org/r/20250614124914.207540-1-xu.yang_2@nxp.com Signed-off-by: Greg Kroah-Hartman

usb: chipidea: imx: implement workaround for ERR051725

2025-06-19T10:28:25+00:00

ERR051725: USB: With the USB controller configured as device mode, Clearing the RS bit of USBCMD register fails to cause USB device to be detached Description 1. USB controller working as high speed device mode with USB gadget function enabled 2. Cable plugged into USB host 3. Use case is software-controlled detach from USB device side The expected result is device side terminations removed, increase in USB signal amplitude, USB host detect device is detached. But the issue is that the clear RS bit of USBCMD register cannot cause device detach event. Workaround - Use the below steps to detach from the host: write USBCMD.RS = 0b write CTRL2[7:6] = 01b write CTRL2[8] = 1b - As CTRL2[8] is set at detach case, so attach the steps should add clear CTRL2[8]: write USBCMD.RS = 1b write CTRL2[8] = 0b Signed-off-by: Xu Yang Acked-by: Peter Chen Link: https://lore.kernel.org/r/20250614125645.207732-4-xu.yang_2@nxp.com Signed-off-by: Greg Kroah-Hartman

usb: chipidea: imx: add imx_usbmisc_pullup() hook

2025-06-19T10:28:25+00:00

It's used to do other pullup related operations if needs. Signed-off-by: Xu Yang Acked-by: Peter Chen Link: https://lore.kernel.org/r/20250614125645.207732-3-xu.yang_2@nxp.com Signed-off-by: Greg Kroah-Hartman

usb: chipidea: udc: add CI_HDRC_CONTROLLER_PULLUP_EVENT event

2025-06-19T10:28:25+00:00

The device controller will send CI_HDRC_CONTROLLER_PULLUP_EVENT event when it's going to pullup or pulldown data line. Signed-off-by: Xu Yang Acked-by: Peter Chen Link: https://lore.kernel.org/r/20250614125645.207732-2-xu.yang_2@nxp.com Signed-off-by: Greg Kroah-Hartman